Executive brief
Apache OFBiz, an open-source enterprise resource planning (ERP) system, is affected by multiple security vulnerabilities including cross-site scripting, path traversal, and code injection. These flaws could allow an attacker to manipulate web content, access restricted files on the server, or execute unauthorized code. Such an exploit could lead to the theft of sensitive business data, unauthorized access to corporate resources, or a complete compromise of the ERP system.
Technical details
Apache OFBiz versions prior to 24.09.06 contain multiple vulnerabilities categorized as CWE-79 (Cross-site Scripting), CWE-22 (Path Traversal), and CWE-94 (Code Injection). The root cause involves improper neutralization of user-supplied input during web page generation and insufficient validation of pathnames and code generation logic. An attacker could leverage these flaws over the network to perform directory traversal to read sensitive files, inject malicious scripts into the browser sessions of other users, or execute arbitrary code on the server. Users are advised to upgrade to version 24.09.06 to mitigate these risks.
Affected products
- Apache OFBiz before 24.09.06
Timeline
- 2026-05-19: advisory: Initial disclosure by Apache Software Foundation
- 2026-05-19: patched: Fix released in version 24.09.06